From: Hank Grabowski <hankgrabowski@gmail.com>
Date: Mon, 6 Nov 2023 16:25:13 +0000 (-0500)
Subject: Use strtok to find QP's in Uri for OAuth redirect processing
X-Git-Url: https://git.mxchange.org/?a=commitdiff_plain;h=35a726a961a8298889738d7b5b063a559d689129;p=friendica.git

Use strtok to find QP's in Uri for OAuth redirect processing
---

diff --git a/src/Module/OAuth/Token.php b/src/Module/OAuth/Token.php
index 7e22a88dab..25c0c69137 100644
--- a/src/Module/OAuth/Token.php
+++ b/src/Module/OAuth/Token.php
@@ -90,10 +90,10 @@ class Token extends BaseApi
 			$me = null;
 		} elseif ($request['grant_type'] == 'authorization_code') {
 			// For security reasons only allow freshly created tokens
-			$uri = new Uri($request['redirect_uri']);
+			$redirect_uri = strtok($request['redirect_uri'],'?');
 			$condition = [
 				"`redirect_uri` LIKE ? AND `id` = ? AND `code` = ? AND `created_at` > ?",
-				'%' . $uri->getScheme() . '://' . $uri->getHost() . $uri->getPath() . '%', $application['id'], $request['code'], DateTimeFormat::utc('now - 5 minutes')
+				$redirect_uri, $application['id'], $request['code'], DateTimeFormat::utc('now - 5 minutes')
 			];
 
 			$token = DBA::selectFirst('application-view', ['access_token', 'created_at', 'uid'], $condition);
diff --git a/src/Security/OAuth.php b/src/Security/OAuth.php
index 7655398b35..f6a01a2a87 100644
--- a/src/Security/OAuth.php
+++ b/src/Security/OAuth.php
@@ -131,8 +131,7 @@ class OAuth
 		}
 
 		if (!empty($redirect_uri)) {
-			$uri = new Uri($redirect_uri);
-			$redirect_uri = $uri->getScheme() . '://' . $uri->getHost() . $uri->getPath();
+			$redirect_uri = strtok($redirect_uri, '?');
 			$condition = DBA::mergeConditions($condition, ["`redirect_uri` LIKE ?", '%' . $redirect_uri . '%']);
 		}
 
@@ -143,6 +142,7 @@ class OAuth
 		}
 
 		// The redirect_uri could contain several URI that are separated by spaces.
+		$exploded = explode(' ', $application['redirect_uri']);
 		if (($application['redirect_uri'] != $redirect_uri) && !in_array($redirect_uri, explode(' ', $application['redirect_uri']))) {
 			return [];
 		}